Privacy Policy

Courtesy translation. In case of discrepancies, the Italian version prevails.

0. Introduction

Pursuant to European Regulation 679/2016 (the so-called "GDPR"), this Privacy Notice describes how Gruppo Spaggiari Parma S.p.A. ("Spaggiari") manages the personal data of visitors who access, by electronic means, the address https://www.spaggiari.eu (hereinafter also the "Website") as well as all the websites and landing pages owned by Gruppo Spaggiari Parma (hereinafter the “Properties”). Finally, the notice also concerns the data processing carried out for marketing purposes following offline collection that may take place at events and trade fairs.
Please note that, for data processing carried out through the SaaS platforms of Gruppo Spaggiari Parma (e.g. the processing carried out in ClasseViva), specific notices are published on the website of the platform itself, to which reference is made for any further detail.
This Notice concerns exclusively the Website and the Properties, as well as offline collection at events, and does not refer to other websites visited by the user through hypertext links that may be present on the Website and/or the Properties.
The use of other websites and services, even through links present on the Website or the Properties, may be subject to different terms and privacy notices.

1. Roles in the processing

Gruppo Spaggiari Parma S.p.A., a company with registered office at via F. Bernini n. 22/A, 43126 Parma (PR), VAT no./Tax Code 00150470342, privacy@spaggiari.eu, acts as the data controller of personal data (hereinafter the "Controller").

1.1 Data Protection Officer

Gruppo Spaggiari Parma S.p.A. has formally appointed a Data Protection Officer ("RPD" or "DPO") and an internal Compliance Function, whom the user may contact to exercise their rights and to receive any information relating to the handling of the same. The DPO and the Compliance Function can be contacted at the e-mail address: privacy@spaggiari.eu. 

2. Types of data processed, purposes and legal basis.

All data collected and processed are handled in compliance with the applicable EU and national legislation, including laws and regulations issued by Authorities legitimately empowered to do so.

 

2.1 Cookies and other tracking systems

The so-called "technical" tracking tools are third-party services used solely for the purpose of "carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the contracting party or the user to provide that service" (see Article 122(1) of Legislative Decree (D.Lgs.) 196/2003, as amended).
The so-called "analytics" tracking tools are used to assess the effectiveness of a service provided or to help measure its "traffic", i.e. the number of visitors, possibly also broken down by geographical area, time slot of the connection or other characteristics. Spaggiari, except for the exceptions set out in the cookie policy, uses these third-party services only through data minimisation measures, for the sole purpose of producing aggregate statistics.
The Website and the Properties install cookies. For more detailed information on cookies and their retention periods, please consult the Cookie Policy, which can be reached through the dedicated link in the footer of the Website and of each Property.

2.2 Mandatory nature of the processing and consequences

The provision of the personal data required to access the above services is mandatory to the extent that, in the absence of such data, it will not be possible to provide the requested services. This means that the user is free not to provide the data, but this could make it impossible to provide the service correctly.
Unless expressly indicated otherwise, the processing of such data does not require the consent of the data subject and is strictly instrumental to the fulfilment of their request.
Where processing is based on consent, the user is reminded that they have the possibility, at any time, to withdraw the consent given, without such withdrawal, however, affecting the lawfulness of the processing carried out while the consent was in force.
Finally, the Website and/or the Properties may use the information present on the device (for example: information and parameters on the operating system, unique IDs and other data of the computer device used by the user) to allow users efficient and reliable browsing.
The data processing operations necessary for the operation of the Website and/or the Properties that cannot be disabled store personal information and allow Spaggiari to count visits and traffic sources in order to measure and improve the performance of its Website and/or Properties. This kind of information also makes it possible to monitor and prevent fraudulent activity and to ensure that the systems operate securely.

2.3. Processing methods and retention periods

The processing takes place in electronic and paper format, with logic strictly related to the above purposes; the data are kept only for the time necessary to achieve the purposes for which they were collected and will be deleted at the end of that period, as better indicated in the table above, unless the data themselves must be kept in order to comply with legal obligations or to establish a right in legal proceedings.

Specific security measures are observed to prevent data loss, unlawful or improper use and unauthorised access.

3. Processing methods and retention periods

Gruppo Spaggiari Parma offers several support services to users.
With reference to the support provided within the SaaS services accessible upon authentication, please refer to the privacy notices relating to the individual services. In this context, Gruppo Spaggiari Parma acts as data processor on behalf of the data controller identified in the individual service.
For support accessible from the Controller's corporate website, a dedicated page is available through which users can interact with a chatbot trained mainly on the published FAQs and support information. Any data provided by users are processed exclusively for support, assistance and request-handling purposes and are not used for marketing purposes.
Where information is requested relating to the SaaS services, the chatbot directs the user to the reserved area accessible upon authentication. The data entered during interactions are not used to train models and do not flow into the system's knowledge base.
Telephone support may also make use of an automatic responder based on speech synthesis and keyword recognition, used to provide first-level information and to direct calls to the competent support channel. At present, this solution is not configured as a conversational artificial intelligence system, but as a speech synthesis and request routing system. Any future technological developments will be accompanied by an update of this notice.

4. Recipients of the data

For the pursuit of the purposes described in the preceding Art. 2, the data may be communicated to and become known to/by: employees and subordinate workers and, in general, the personnel of Gruppo Spaggiari Parma, who will act as persons authorised to process personal data, specifically appointed by the Controller.
The user's data may also be processed by service providers for the management of IT systems (for the maintenance of the IT infrastructure); these parties will act as data processors specifically appointed by the Controller pursuant to Article 28 of the GDPR, listed below.

 

Name	Purpose	Role
Stardata S.r.l.	With regard to the technical provision of IT services and maintenance of the IT infrastructure.	Data processor of personal data (pursuant to Art. 28 of the GDPR).
Akamai Technologies S.r.l.	With regard to the provision of Content Delivery Network "CDN" services. For further details, please refer to the third-party notice: https://www.akamai.com/it/legal/compliance/privacytrust-center.	Data processor of personal data (pursuant to Art. 28 of the GDPR).
Hubspot	With regard to support services via chatbot.	Data processor of personal data (pursuant to Art. 28 of the GDPR).

 

For the processing relating to the Scuola Shop service, and in particular for the completion of payments and/or the delivery of the products purchased, Gruppo Spaggiari Parma may use third-party partners such as: shipping service, online payment provider, third-party suppliers, MePA system. In these cases the parties will act as independent controllers, separate from Gruppo Spaggiari Parma, which therefore cannot be held responsible in any way for any problems encountered. In any event, although we choose our suppliers also on the basis of their ability to guarantee high standards of security and customer care, in the event of problems users are requested to inform Spaggiari so as to enable us to better assess our partners.
The processing and retention of data are carried out in Italy and the EU and no transfers to other non-EU countries are envisaged, nor will such data be disseminated to the public; in any case, in the event of a transfer to non-EU countries, we will take care to adopt the mechanisms protecting the data subject referred to in Articles 44 et seq. of the GDPR.
Partners and suppliers can access only anonymous and/or aggregated information, preventing the correlation with the natural person who is the user of the App, so as not to allow identification in any way.

5. Links to social networks

On the Website and on the Properties there are links that refer to Spaggiari's social channels. In this regard, as specified by the Garante, it is pointed out that “if the advertising banners or the links to social networks on the site are simple links to third-party sites that do not install profiling cookies, no notice and consent are needed”.
In any case, it is specified that, as the Garante highlights in its FAQ on cookies, “for third-party cookies installed through the site, the obligations of notice and consent fall on the third parties, but the owner of the site, as technical intermediary between them and the users, is required to include in the "extended" notice the updated links to the notices and consent forms of the third parties themselves”; therefore, here is the link to the cookie policies of Facebook/Instagram/Whatsapp (HERE) and of LinkedIn (HERE).

 

6. Rights of data subjects

In relation to the processing described in this Notice, the data subject / user may exercise the rights listed in this section, laid down in Articles 15 to 21 of the GDPR. In particular:

• Right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to obtain access to their personal data – including a copy thereof – and the communication, among others, of the following information:

  1.    purposes of the processing;

  2.    categories of personal data processed;

  3.    recipients to whom the data have been or will be disclosed;

  4.    retention period of the data or the criteria used;

  5.    rights of the data subject (rectification, erasure of personal data, restriction of processing and right to object to processing);

  6.    right to lodge a complaint;

  7.    right to receive information on the source of your personal data where they were not collected from the data subject;

  8.    the existence of automated decision-making, including profiling.

   

• Right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning them and/or the completion of incomplete personal data;

   

• Right to erasure (right to be forgotten) – Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning them, where:

  1.    the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  2.    the data subject has withdrawn their consent and there is no other legal ground for the processing;

  3.    the data subject has successfully objected to the processing of personal data;

  4.    the data have been unlawfully processed;

  5.    the data must be erased to comply with a legal obligation;

  6.    the personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1, GDPR.

  The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims.

   

• Right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing, where:

  1.    the data subject contests the accuracy of the personal data;

  2.    the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use

  3.    the personal data are required by the data subject for the establishment, exercise or defence of legal claims;

  4.    the data subject has objected to the processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

   

• Right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they have provided to the Controller and the right to transmit those data to another controller without hindrance, where the processing is based on consent and is carried out by automated means. Furthermore, the right to have their personal data transmitted directly from the Controller to another controller where technically feasible;

   

• Right to object – Article 21 GDPR: the right to object to the processing of personal data concerning them, unless there are legitimate grounds for the Controller to continue the processing;

   

• Right to lodge a complaint with the competent authority for personal data, by sending the complaint to the Garante, at Piazza Venezia, n. 11 – 00187, Roma; e-mail: protocollo@pec.gpdp.it, or to the supervisory authority of their place of habitual residence, of work, or of the place where the alleged infringement occurred.

The above rights may be exercised by contacting the Controller at the addresses indicated in Article 1 above. A dedicated form is also available for access and erasure requests: Data privacy request. Requests submitted through the form are verified by e-mail and handled within 30 days. The exercise of rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including because of their repetitive character, the Controller may charge you a reasonable fee, in the light of the administrative costs incurred to handle your request, or refuse to act on your request.

We also inform you that the Controller may request further information necessary to confirm the identity of the data subject.

v. 19/06/2026